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Abstract — Recently, Hwang has proposed a decoy 
state method in quantum key distribution (QKD). In 
Hwang's proposal, the average photon number of the 
decoy state is about two. Here, we propose a new 
decoy state scheme using vacua or very weak coherent 
states as decoy states and discuss its advantages. 

I. Introduction 

The security of conventional cryptography is often based 
on unproven computational assumptions such as the hardness 
of factoring. In contrast, quantum cryptography offers uncon- 
ditional security based on fundamental laws of physics, par- 
ticularly, the quantum no-cloning theorem. The best-known 
application of quantum cryptography is quantum key distri- 

■ bution (QKD). The goal of QKD is to allow two users to com- 
municate in absolute security in the presence of an eavesdrop- 
per. The best-known QKD protocol (BB84) was published by 
Bennett and Brassard in 1984 pQ. 

The procedure of standard BB84 QKD scheme is as follows. 

■ First, Alice sends Bob a time-ordered sequence of single pho- 
tons, each of which in one of the four possible polarizations — 

, horizontal, vertical, 45-degrees and 135-degrees. Second, for 

■ each photon, Bob makes randomly one of two measurements: 
diagonal or rectilinear. Third, Bob writes down the bases and 

. measurement outcomes and publicly acknowledges his receipt 
of Alice's photons. Fourth, Alice and Bob then broadcast their 
, bases. For the cases when they use different bases, they throw 

■ away their polarization data. For the cases when they use the 
' same bases, they keep their polarization data. Note that in the 
, absence of noise and Eve, Alice and Bob's polarization data 

■ should be the same. Next, Alice and Bob perform some test 
for tampering. For instance, Alice and Bob can pick a ran- 
dom subset of their photons and broadcast their polarization 
data. From there, they compute the quantum bit error rate 
(QBER) of their transmission. If this QBER is larger than 
some prescribed value, they abort the protocol. On the other 
hand, if this QBER is within some prescribed value, then the 
QKD protocol is successful and they proceed with key gener- 
ation. Key generation may be done by applying two different 
operations: a) error correction and b) privacy amplification. 

The security of QKD protocols with ideal devices and, more 
recently, with imperfect devices has been proven. Since a 
single-photon source is an experimental challenge, a common 
experimental source is a weak (coherent) laser pulse, which, 
if phase randomized, can be regarded as a Poisson distribu- 
tion in the number of photons. This means that there is a 
non-zero probability of having multi-photons. In principle, 
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Eve can perform a quantum non-demolition measurement in 
photon number. If she sees a single photon, she suppresses 
the signal. If she sees a multi-photon, she steals one pho- 
ton and resends the rest to Bob. She may try to mask her 
presence by the usual loss in a quantum channel. Note, how- 
ever, that with such an attack, multi-photon signals exhibit 
different outcomes from single-photon signals. For instance, 
multi-photons give a much higher yield than single photons. 

Recently, Hwang |5j has provided an ingenious method to 
defend against the above attack by Eve. His idea is that, in 
addition to regular signal states, Alice also uses some decoy 
states. For each signal, Alice randomly chooses to send either 
a signal state or a decoy state. After Bob's measurements 
of all signals, Alice tells Bob which signals are decoy states. 
They can then compare their outcomes for the decoy states 
and use their data to detect eavesdropper's attack. 

In Hwang's original proposal, the average photon number of 
the decoy state is about two and is, thus, rather high by QKD 
standard. The goal there is to use the observed fractional loss 
of the decoy state to constrain the multi-photon yield in QKD, 
thus detecting eavesdropping attacks. 

II. Our idea 

We propose several new ideas here. First of all, we pro- 
pose a refined data analysis where the specific properties of 
the decoy state such as the bit error rate are analyzed sepa- 
rately from the original signal. Second, we show that Hwang's 
scheme can be combined with existing security proofs of QKD 
[Hill], thus allowing rigorous proofs of security. Third, we show 
that it may be advantageous to use either vacua or very weak 
coherent states or both as decoy states. On one hand, by using 
a vacuum as a decoy state, Alice and Bob can verify the so- 
called dark count rates of their detectors. On the other hand, 
by using a very weak coherent pulse as a decoy state, Alice and 
Bob can easily lower bound the yield of single-photon pulses. 
These two types of decoy states can be easily combined with 
each other and with Hwang's original proposal The usage of 
decoy states may have some advantages. For instance, they 
may provide useful testing procedure and may increase the 
secure key generation rate, increase security and the distance 
of QKD. One specific example is that they can achieve secure 
QKD even at high loss. 
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